CVE-2022-21633: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVE-2022-21633 is a vulnerability in Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)., rated Moderate by Microsoft, with a CVSS 3.1 base score of 4.9 (Medium). An attacker can exploit it remotely over the network, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 1.47% probability of exploitation activity in the next 30 days, higher than 74% of all scored vulnerabilities. Microsoft released the fix on 19 October 2022, outside Patch Tuesday. It affects 2 products in 1 product family (Other).

Key facts

CVE ID: CVE-2022-21633
Severity: Medium CVSS 4.9
Microsoft severity: Moderate
Exploited in the wild: No
Publicly disclosed: No
EPSS: 1.47% (percentile 74%)
CISA KEV: Not listed
Released: 19 October 2022
Last updated: 19 October 2022
Patch Tuesday: October 2022 Patch Tuesday
Product families: Other

CVSS score and vector

Microsoft scores CVE-2022-21633 at 4.9 (temporal 4.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (2)

Other

Product	Security update	Type	Fixed build	Restart
18584-16820	CBL-Mariner Releases	Security Update	8.0.31-1	No
18585-16823	CBL-Mariner Releases	Security Update	8.0.31-1	No

NIST NVD data

NVD status: Modified
NVD CVSS: 4.9 (MEDIUM)
Published to NVD: 18 October 2022
NVD last modified: 17 June 2026

Affected configurations (CPE)

Product	Vulnerable versions
mysql	from 8.0, up to and including 8.0.30
oncommand insight	all listed versions
oncommand workflow automation	all listed versions

References

Revision history

Version	Date	Description
1.0	19 October 2022	Information published.